CDPS Audit and Risk Committee (ARC)

John-Mark Frost (JMF) – Chair

Samina Ali (SA) 

Andrea Gale (AG)

Jonathan Pearce (JP)

Ben Summers (BS)

Guests:

Jonathan Maddock (JMa) – TIAA

CDPS Staff:

Joanna Goodwin (JG) – Item 2 only 

Harriet Green (HG) – CEO 

Myra Hunt (MH) – CEO 

Phillipa Knowles (PK) 

Kath Morgan (KM) – From Item 3 

Secretariat:

Jon Morris (JM)

The meeting opened at 14:00 

1. The Chair welcomed Members to the meeting. There were no apologies for absence and the Chair noted that the committee was quorate.

1.2 The ARC approved the minutes of the meeting held on 22 January 2025 as a true and accurate record.

1.3 The action log was received, and members raised no specific concerns or queries on progress. 

1.4 Members confirmed that there were no items to be discussed which were not represented on the agenda. 

2.1 JM presented the risk paper, introducing the hot topic from the Operational Risk Register, namely the Outsourcing of Services in light of recent service provider changes, and noted the changes to the strategic risks this quarter.

2.2 JM announced the appointment of Ethos Chain, based in Swansea, to manage Commercial Services, highlighting their 50 years of experience in the Welsh public sector and the inclusion of a budget allocation for procurement-related project work within the contract. He also confirmed the selection of Darwin Grey to oversee Legal Services, replacing Berry Smith. Both JM and MH underscored the critical importance of effective onboarding and implementation processes for these new contracts to guarantee smooth transitions and the maintenance of high service standards. MH further provided historical context, reflecting on the longstanding partnerships with previous suppliers, Curshaw/Posterity Global and Berry Smith, who had offered valuable strategic guidance. The decision to move to new suppliers was driven by a desire for better market offerings and cost efficiency, rather than any concern over the service received from either company. 

JG joined the meeting.

2.3 JG presented a deep dive on Strategic Risk 6, Workplan for 2025-26, outlining key controls and mitigations to manage the risk, including revised board focus, holding vacancies, and detailed resourcing plans. JG opened the discussion to ARC members for comment. 

2.4 ARC members asked for detail on the level of granularity that has been agreed on the workplan, and how the tooling allows progress monitoring. JG explained that the work plan is a high level road map throughout the year with key outcomes and outputs per quarter broken down into a monthly cadence. The Senior Leadership Team will review from a quarterly perspective; is the work planned the right shape, size, people, availability, etc. CDPS also has monthly prioritisation sessions where we check in then on progress. This gives space for the teams can feedback to the organisation every two sprints. 

2.5 JG expanded that the road map is very much aligned to the outcomes and deliverables CDPS needs to meet. It gives us that flexibility in terms of the how and setting targets & using sprints to sign work and monitor. Each project is “t-shirt sized” to estimate how much resource is required, then allocated to a squad, giving them flexibility to scope and shape in the defined time period. 

2.6 Members discussed the challenges of using agile methodologies in a waterfall environment, emphasising the importance of monitoring and flexibility in managing the work plan and resources. JG took onboard comments regarding the need for high trust and flexible budgets when working with partners in an agile environment and acknowledged the challenges & outlined the steps taken to manage expectations and ensure effective delivery. 

2.7 The committee agreed that historically there have been a high number of external dependencies which have then withdrawn and acknowledged that the move towards WG should resolve. 

2.8 ARC members were content that CDPS have the appropriate forms of assurance and controls in place for Strategic Risk 6 following JG’s presentation, which explained CDPS’s approach in high detail. JG invited further suggestions to be given offline. 

2.9 ARC members accepted the Risks paper and were content that the CEO and SLT were managing the risks effectively. 

KM joined the meeting.

JG left the meeting.

3.1 JM presented a paper explaining the rationale, decision-making process and costs involved in direct awarding Financial advisory and payroll services to Azets for 2025-26. The paper was seeking assurance from ARC that the CDPS executive had acted appropriately to ensure continuity of service and value for money. 

3.2 Paragraph redacted – commercially sensitive 

3.3 ARC members were content that the CDPS executive had acted appropriately with this direct award.

Decision – ARC were content that CDPS was acting appropriately with the proposed direct award and were happy for Azets to provide limited financial services for 2025-26. 

4.1 There were no new items identified in the Fraud Register for discussion and consideration by the ARC. 

5.1 JM presented the Crisis Test Exercise report, noting that these reports do not normally come to ARC for scrutiny, but in the spirit of openness, the executive would like to present the report for reassurance and invite comment from members for improvement.

5.2 The exercise involved a simulated crisis scenario, and the report detailed the decisions taken and lessons learned. The scenario was designed to be stressful and realistic, testing the team's response under pressure. 

5.3 MH explained the exercise was considered valuable and well-executed. It was noted that it was challenging to find time to conduct the exercise, but it was ultimately very beneficial. The team learned a lot from the experience, and it was seen as a credit to the operations team.

5.4 The ARC suggested making future exercises more realistic, possibly involving external parties to add an element of unpredictability. It was also mentioned that insurance companies might offer such exercises for free, which could be considered for future tests. 

ACTION – JM to investigate the possibility of an externally run crisis exercise.  

5.5 ARC members commended the team for conducting the exercise and recognised the importance of making time for such preparedness activities. 

6.1 JMa introduced the SICA report and progress against the annual plan. There were no comments or queries from ARC members.

6.2 JMa introduced the Internal Audit Annual Report for 2024-25 which provided a positive assessment of the organisation's risk management, control, and governance processes. The report highlighted substantial assurance five of the six audits conducted in the year. The Chair wanted to note the efforts involved in the audit results achieved last year and send congratulations from ARC to all staff members.

6.3 JMa introduced the Follow-up report, which verifies the closure of any previous priority 1 & 2 recommendations. JMa noted that all recommendations in scope had been verified as closed. There were no concerns from ARC members.

6.4 JMa introduced the Key Financial Controls audit report, noting that this is the first year with a fully in-house finance service. This audit achieved an assessment of “Substantial Assurance”, the highest possible grade. There were no concerns from ARC members.

6.5 JMa introduced the Risk Management Framework audit report. This audit achieved an assessment of “Substantial Assurance”, the highest possible grade. ARC members, noted the progress CDPS has made in its approach to risk in the last 12 months and commended the CEO, SLT, and JM for their efforts. There were no concerns from ARC members.

6.6 JM gave an update on internal audit recommendations, explaining that there were no outstanding recommendations. 

7.1 KM presented the draft end of year finance report, and invited ARC members for comment. MH addressed the above limit carry-forward from 2024-25 and explained CDPS’s plan to utilise the funds early this financial year, probably on data expertise for projects. 

7.2 ARC members questioned the budget underspend for 2025-26, asking if this should be allocated at the start of the year. MH clarified that we were unable to fully budget at this point as we currently do not know whether last year’s carry-forward will be recalled to WG. KM agreed to reallocate into the Streamlining Welsh Benefits until a final position is known. 

ACTION – KM to reallocate 2024-25 excess carry-forward into SWB project pending decision by WG Finance Director.  

7.3 Committee members questioned current financial planning processes pending sign off from WG for the Operational Plan and 2025-26 budget. KM & PK confirmed that CDPS is currently on monthly drawdowns until the budget and KPIs have been signed off by WG. Both gave assurances that the process is being managed effectively and is not expected to lead to any disruption in company operations. 

7.4 JP asked for progress on switching bank account. KM confirmed that she and the finance assistant now have access and are currently training. Switchover target is July to have all processes moved to the new provider.

7.5 KM noted that the formal externally audited accounts are scheduled to be presented to ARC in October, the same timescales as the 2023-24 accounts. 

7.6 JMF expressed his appreciation to the finance team for the report, especially with the turnaround of less than a month since year end.

Decision – ARC decided to approve the draft 2024-25 end of year finance report. 

8.1 JM presented the financial regulations, which were reviewed and updated to reflect the insourcing of services and other relevant changes for approval by ARC. JM explained that changes are minimal compared with the previously approved version and detailed the three amendments.

8.2 ARC members were content with the changes, pending one minor change; the removal of a supplier’s name in the outsourced services section.

ACTION – JM to remove the named supplier in the outsourced services section, the publish the Financial Regulations to live. 

Decision – ARC decided to approve new Financial Regulations for immediate adoption. 

9.1 AG suggested that SLT consider a new Strategic Risk regarding possible budget amendments in the first year of the new Senedd term.

9.2 SA suggested SLT consider resource and skills management risks in the Workplan, Strategic Risk 6. 

9.3 JP questioned CDPS’s position on succession planning. PK described that the company brought in to run this project on CDPS’s behalf are running behind schedule but will hopefully be in a position to share findings in the coming weeks for a July rollout. 

9.4 HG requested feedback from committee members on the Comms updates they have been receiving recently, though acknowledged this was more of a Board question than ARC. Members noted that they find the updates are useful but would appreciate a lower frequency whist maintaining current level of detail. 

9.5 AG noted that she would be unavailable for the next ARC meeting as she will be out of the country for most of July, into August.

ACTION – JM and PK to rearrange July ARC date to ensure quorum can be achieved.

9.6 JMF acknowledged that some non-executive directors are stepping down before the next ARC meeting. He expressed gratitude for their efforts, hard work, and contributions to the discussions. 

10.1 In-camera session between ARC members and JMa. No CDPS staff attended, and the discussion was not noted. 

The meeting closed at 16:50.